secureString() does now no longer encode in entities by default, XHTML fixes, missing...