XSS flaw correction

With a client IE < 10 there was a XSS security flaw. Other browsers were
not affected.
Also corrected spacing display with IE<10.
Added password option
Merge remote-tracking branch 'upstream/master'