Security Patch

• Don't list directory contents by default
• Clone parameters when passed from parent controller to child controller
• Encode parameters serialized in first page response and decode during rehydration to prevent XSS attacks