Security added, but not finished
HTML fixed in all .html.erb pages