Cleaning up meta refresh and fixing potential XSS hole at the same time