LPS-32031

These are XSS fixes. Some of them are in javascript. @ipeychev, can you please take a look at them?