steps to avoid insecure deserialization