tightened security, hopefully it will not break anything
completely removed jQuery dependency, replaced with underscore