added Cross Site Scripting Protection to web.xml
added <c:out /> on all user provided data output to prevent Cross Site
Scripting