Harden session/path/ID validation and fix XSS for public-facing web version

Add per-session file isolation for multi-user support

Initial commit