Use subprocess.Popen() instead of os.system()

https://bugzilla.mozilla.org/show_bug.cgi?id=913455
Set X-Frame-Options header to all responses

https://bugzilla.mozilla.org/show_bug.cgi?id=922043
Use is_safe_url() instead of home-grown check

https://bugzilla.mozilla.org/show_bug.cgi?id=922539
Use gravatar over HTTPS

https://bugzilla.mozilla.org/show_bug.cgi?id=922078
Don’t hard-code http in Wikipedia URL