Added some security to the config file to avoid any Xsite posts.  Also removed start.php and moved it to 'dashboard.php'