fixed critical XSS bug that can deanonymize user
use hash of /dev/urandom data instead of urandom data directly, to avoid leaking state of entropy
add Content-Security-Policy so if there are other xss vulns they won't execute
version bump
fixed issue with pyinstaller packaging Qt4 on some OSX