security fixes

This is still XSS-vulnerable.