some xss-fixing, new location for captcha-image, reload button