Fix HTML injection vulnerability via profile bio