Using directly the update.exe i can bypass the feedURL and download new update that can potentially be from not auth/intended server. What can i do to enforce it.