Security findings fixed

CSP tightening, an open redirect, a timing attack, XSS, and path traversal issues, all closed in one day.