Remove all trailing whitespace
Fix defense B so that the hidden field is a hash of session_id