fix another xss exploit and add some info to /help