Fix XSS via JSON
Add CSRF protection to admin forms