diff --git a/engine/common/cvar.c b/engine/common/cvar.c
index 35de41eff..6928203b1 100644
--- a/engine/common/cvar.c
+++ b/engine/common/cvar.c
@@ -897,6 +897,7 @@ Cvar_Set
 static cvar_t *Cvar_SetCore (cvar_t *var, const char *value, qboolean force)
 {	//fixme: force should probably be a latch bitmask
 	char *latch=NULL;
+	qboolean changed;
 
 	COM_AssertMainThread("Cvar_SetCore");
 
@@ -1002,33 +1003,33 @@ static cvar_t *Cvar_SetCore (cvar_t *var, const char *value, qboolean force)
 
 	latch = var->string;//save off the old value (so cvar_set(var, var->string) works)
 
-	var->string = (char*)Z_Malloc (Q_strlen(value)+1);
-	Q_strcpy (var->string, value);
-	var->value = Q_atof (var->string);
- 	var->ival = Q_atoi (var->string);
+	changed = (!latch) || strcmp(latch, value);
 
 	var->flags &= ~CVAR_TEAMPLAYTAINT;
-
+	if (changed)
 	{
-		char *str = COM_Parse(var->string);
-		var->vec4[0] = atof(com_token);
-		str = COM_Parse(str);
-		var->vec4[1] = atof(com_token);
-		str = COM_Parse(str);
-		var->vec4[2] = atof(com_token);
-		if (!str || !*str)
-			var->vec4[3] = 1;
-		else
+		var->string = Z_StrDup (value);
+		var->value = Q_atof (var->string);
+		var->ival = Q_atoi (var->string);
+
 		{
+			char *str = COM_Parse(var->string);
+			var->vec4[0] = atof(com_token);
 			str = COM_Parse(str);
-			var->vec4[3] = atof(com_token);
+			var->vec4[1] = atof(com_token);
+			str = COM_Parse(str);
+			var->vec4[2] = atof(com_token);
+			if (!str || !*str)
+				var->vec4[3] = 1;
+			else
+			{
+				str = COM_Parse(str);
+				var->vec4[3] = atof(com_token);
+			}
 		}
-	}
 
-	if (latch)
-	{
-		if (strcmp(latch, value))
-		{
+		if (latch)
+		{	//don't do this on registration.
 			var->modified=true;	//only modified if it changed.
 			var->modifiedcount++;
 			if (var->callback)
@@ -1049,6 +1050,7 @@ static cvar_t *Cvar_SetCore (cvar_t *var, const char *value, qboolean force)
 #endif
 			}
 		}
+
 		if ((var->flags & CVAR_ARCHIVE) && !(var->flags & CVAR_SERVEROVERRIDE) && cl_warncmd.ival)
 		{
 			if (var->latched_string)
@@ -1058,12 +1060,11 @@ static cvar_t *Cvar_SetCore (cvar_t *var, const char *value, qboolean force)
 			}
 			else
 			{
-				if (strcmp(latch, value))
+				if (!latch || strcmp(latch, value))
 					Cvar_ConfigChanged();
 			}
 		}
 
-
 		Z_Free (latch);	// free the old value string
 	}
 
diff --git a/engine/common/net_wins.c b/engine/common/net_wins.c
index da8c970c5..1498a50c8 100644
--- a/engine/common/net_wins.c
+++ b/engine/common/net_wins.c
@@ -160,16 +160,11 @@ static void QDECL NET_Enable_DTLS_Changed(struct cvar_s *var, char *oldvalue)
 	if (!*var->string)
 		var->ival = 0;	//FIXME: change to 1 then 2 when better tested.
 
-	if (var->ival && svs.sockets)
+	if (svs.sockets)
 	{
-		if (!svs.sockets->dtlsfuncs)
-			svs.sockets->dtlsfuncs = DTLS_InitServer();
-		if (!svs.sockets->dtlsfuncs)
-		{
-			if (var->ival >= 2)
-				Con_Printf("%sUnable to set %s to \"%s\", no DTLS provider available.\n", (var->ival >= 2)?CON_ERROR:CON_WARNING, var->name, var->string);
-			var->ival = 0;	//disable the cvar (internally) if we don't have a usable certificate. this allows us to default the cvar to enabled without it breaking otherwise.
-		}
+		svs.sockets->dtlsfuncs = (var->ival)?DTLS_InitServer():NULL;
+		if (!svs.sockets->dtlsfuncs && var->ival >= 2)
+			Con_Printf("%sUnable to set %s to \"%s\", no DTLS provider available.\n", (var->ival >= 2)?CON_ERROR:CON_WARNING, var->name, var->string);
 	}
 }
 cvar_t net_enable_dtls		= CVARAFCD("net_enable_dtls", "", "sv_listen_dtls", 0, NET_Enable_DTLS_Changed, "Controls serverside dtls support.\n0: dtls blocked, not advertised.\n1: clientside choice.\n2: used where possible (recommended setting).\n3: disallow non-dtls clients (sv_port_tcp should be eg tls://[::]:27500 to also disallow unencrypted tcp connections).");
@@ -253,7 +248,8 @@ static void NET_TLS_Provider_Changed(struct cvar_s *var, char *oldvalue)
 	}
 
 #if defined(HAVE_DTLS) && defined(HAVE_SERVER)
-	Cvar_ForceCallback(&net_enable_dtls);
+	if (net_enable_dtls.string)	//might not be registered yet...
+		Cvar_ForceCallback(&net_enable_dtls);
 #endif
 }
 #endif
@@ -2133,6 +2129,8 @@ qboolean NET_StringToAdrMasked (const char *s, qboolean allowdns, netadr_t *a, n
 
 qboolean NET_IsEncrypted(netadr_t *adr)
 {
+	if (adr->type == NA_LOOPBACK)
+		return true;	//might as well claim it, others can't snoop on it so...
 #ifdef SUPPORT_ICE
 	if (adr->type == NA_ICE && ICE_IsEncrypted(adr))
 		return true;