fixed XSS problems

It was possible to use HTML in names and certain values. This patch
fixes that and add unit tests for the most basic fields.

This breaks wiki syntax support in static right now.