regex check that external ids are valid ids before wrapping in href
removed wrapping user inputted email / url in href tags, added html encoding to pre-filled form fields
Merge pull request #322 from teharrison/develop

more hardening of pages