fix frontend upload update
escape html by default
loading text on submit buttons