fix for xss session hijacking vulnerability in user_log page