add session timeout, error pages, adding XSS and JS injection