fixing secret comparison with constant time compare
fix integration with agora-identity
using bleach to filter bad html