Auto-sense auth cipher from password format
Secure by default: stealth mode, XSS headers, CSP
Fix finalizing templates with trailing '$'
Secure by default - restrictive sandbox limits