properly escaped values in /config.js
changed config file format and added support for user options
added support for URL hijacking in JSON responses