Better XSS prevention (NOTE: must run npm install validator on existing installs)
I think it works
A few minor fixes
Merge master into dev