added test-regexp-dos security test.
added reflected xss security test.
changed reflected xss to exploit invalid username page.