Encode security token
Change header comment to https
Update DOMPurify