I'm concerned that this is potentially an XSS vector because `@mapping.path` and `@mapping.new_url` both come from user-input.

I was able to insert a script tag into the flash message output by providing a malicious `path`: ``/foo/><script>alert(undefined);</script>``

ERB provides a `html_escape` method, aliased to `h()` that escapes HTML, which we can use here. See:
http://api.rubyonrails.org/v3.2.11/classes/ERB/Util.html#method-c-html_escape

I believe (looks at @rgarner) that Rails automatically escapes input to the `link_to` helper. I strongly believe we should `ERB::Util.html_escape` the `@mapping.path`.