added several fixes against xss + unit tests