numerous minor security fixes. no more console. updated to be used as middleware. (untested)