added nonce, html escape and urh checking
Merge remote-tracking branch 'origin/master'