added note about DoS vuln
fixed up html