Fix XSS through string interpolation (bug 1023594)
prevent cookie-based authentication for the API (bug 987932)