fixed xss bugs
Merge branch 'feature/security' into develop