Static and session security fixes for Plug