addressing some of the pen-test vulns (namely: input filtering using regex, cookie eval)