Thanks for testing this stuff out! That admin page is actually broken, I don't actually have a working admin page. As for the XSS stuff, I'm going to go fix that.