bugfix

now exercises aren’t XSS vulnerable anymore; added message if there
aren’t exercises found