fix the signup form and xss bug