csrf
Merge origin/master
fixed xss problems