updating content script security permissions making it more secure, adding some html encoding as well