more hardening of pages

1. regex check that external ids are valid ids before wrapping in href
2. removed wrapping user inputted email / url in href tags
3. added html encoding to pre-filled form fields