Extend bidding. Fix redirect vunerability. Add Haircut.winners.