Added XSS / cookie JS injection fixes but not tested yet.