Fix to the possible script injection on the todo app