Fix RCE and XSS vulnerabilities

See https://github.com/opentechinstitute/luci-commotion-apps/pull/21 for testing instructions

<!---
@huboard:{"order":1.5}
-->