added is_deleted field in db schema;
added xss protection
fixes #4