fixes for potential cross site scripting issues (mostly exploitable by admin users only)