Fix XSS and CSRF issues