two-way US state-to-abbreviation conversion
adds an XSS test that django's strip_tags was failing on