Fixes

Hi Kohsuke,

here is a pull request that fixes many security holes in the project.

In addition there is second commit that add a unit test that fails but I am not able to fix it due to my limited skills in Groovy AST.