XSS, CSRF replace

security vulnerability remove