changelog
xss protection
fixed js in notes