Fix this XSS completely.

It's just the wrong place to do XSS filtering. See
https://code.google.com/p/gitblit/issues/detail?id=526