updates to latest security patch
fixes zen-111 and improves zen-109 while we figure out a long-term solution
removes and ignores .gitkeeps