updated from antimattr master to fix xss attack and session autostart

updated from antimattr master to fix xss attack and session autostart