Mainly a bugfix for XSS. Patches have been refreshed. Added an upstream fix for TLS verification. Now enabled by default. Signed-off-by: Rosen Penev <rosenp@gmail.com>