fix security bugs
check savesession arg
Merge branch 'dev' into dev_web
use safeeval