fixups
more security around the py2/py3 setup.py