web/security: fix typos