xss bug fix
xsrf protection for host page
xss bug fix