added html escaping, xss security and flash messages
updated gemfile