Added a test case for the XSS in limit parameter
Fixed XSS flaw in exception printing
Add possibility to get username and api_key from META header.