protect account from mass loading
add cross site script protection to forms
Merge pull request #28 from webyast/base_sec_fixes

Base sec fixes

Review OK, thanks for the fix!