add set/var and show/var - two rather insecure commands!