Timezone and Close XSS vulnerability

Config options set to not display errors; also added URL checks for
build and preview pages to die if URl field does not start with http://
(reported possibility for XSS possile intrusion in the form)