removed XSS valnurability and moved 'from_page' handling to session
made a tool to serve from gridfs