added noop html sanitization
authenticated user handling moved to insecurity.js
feedback comments are now sanitized

...but not recursively, which resolves #30
added challenge for known vulnerable component