protection against javascript attacks and added an XML feed.  I'm sure the feed is going to get TONS OF USERS
tried to add flash error messages but got internal server error.  got it working again, will leave alone for now