implemented security, but not quite working