XSS

this needs #34 and #33 (hapi updates) merged before, they are included in this optimistic branch