CSRF protection with facebook state. Changed some titles in templates.
cgi.escape given message before displaying in html.
Added @facebook to uid in order to distinguish same id