fix common XSS vulnerability and start with CSRF security