Fix security vulnerability. If a user entered field contains an HTML
script tag then the EL does not escape it automatically. This is fixed
by using a filter which escapes it automatically. Caveat some properties
like URLs should not be escaped as the parameters will not be passed
correctly if they are escaped. Fix this by using a set of whitelisted
properties. For now this list is generated by grepping the source code.
Fix is based on:
http://pukkaone.github.io/2011/01/03/jsp-cross-site-scripting-elresolver.html
https://github.com/pukkaone/webappenhance/tree/master/src/main/java/com/github/pukkaone/jsp