html4.01 -> html5, fix some security issues