Cross site scripting attack fix
SQL attack fix in UserDao
Added SHA1 password encryption - not too sure if correct.
Fixed insecure object reference flaw. Added hashed password authentication (previously the check would happen between a hashed and an unhashed password, which would always fail when logging in)