Updated security notes, to highlight tail content is sent raw to a browser. Updated UI code to HTML encode this content.