Fix RCE and XSS vulnerabilities

See https://github.com/opentechinstitute/luci-commotion-apps/pull/21 for testing instructions