Do not output preview image URL tag for empty page

Having an HTML img tag to display preview image in the home page
doesn't make sense because there is nothing to display in an
empty page.
Sanitize title and author's name

The title field is vulnerable to cross-site scripting attack.
This issue was caused because of an erroneous regular
expression.  The validate method of Post class rejects any title
that matches the regex /<\w+>/. Now, this is fine to reject
title field containing the following script:

    <script>alert('hi')</script>

But, it won't reject the following, because \w does not match
whitespace.

    <script type="text/javascript">alert('hi')</script>

Fix this issue in two ways:

  1. Reject title that matches /<w+/.
  2. Sanitize the HTML that displays title and author's name at
     server-side as well as client-side.

The second point takes care of sanitizing the HTML at DOM level,
so that even if an attacker succeeds in injecting script or HTML
tags not in the whitelist, the DOM sanitizers would still remove
them before it is displayed on the page.