Just did an eyeball review. You've included homedir path in the response rendered JS file. You're exposing underlying directory structure to users even in server mode. This is not appropriate. This info should remain at the server and not at the client side.
