Avoid cross site scripting via link_to in the document views