- Fix a stupid self-XSS. I doubt that there are ways to use it against other users, but well, better safe than sorry - Replace the javascript-on-focus hacks with the `autofocus` attribute