security improvements: escaping fields on facet and item views and closing fullpath disclosure errors on itemController