Target text area better
Turn on CI's cross-site scripting protection
Make a note: we can't currently use CI's CSRF protection because we don't let CI generate our forms for us