- XSS fixes in src/webmail.php