updated checks: added username/password, removed accept headers
added minimum length parameter
no longer throws an exception but you can pass a function/callable that will get called if an xss attack is detected. If no function is passed it will just send an 400 Bad Request header