Added CREDITS.md
Plugged a security hole with addShow.php and editShow.php