optionally allow signed cookies
escape token injected into html
Merge pull request #14 from mtths/master

optionally allow signed cookies, escape token injected into html