Xss fixes in self service signup form