Additional XSS fixing

This is an initial fix to bug 2768 .  This does fix all of the mentioned xss instances, but only implements the first half of Davide's Comment #34.  I added scrubber to addmessage (because it does take in html) but I did not go through and clean up addgoodmessage and addbadmessage.