Sanitize http input

and assorted other fixes