some security adds, change to configuration, saving to db