added environment detection; character escaping for URL creation; csrf filtering; input validation