add url_decode function to HTTP module
added notes to detect-xss