fix xss in message template
add lobos migrations