added ListMetrics and GetUser URL parsing (tested)
explain possible attacks and how they are mitigated
add ListMetrics
fix copy-paste error