fixes #19 this commit also contains security fixes

sanitize the filename on new-file-creation
adds h() to some output; fixes a couple of xss issues.