some $.html( -> $.text(

Thoses that are obvious and easy to fix.

we shoudl have I think a travis test that grep for .html( and return
less than 20 lines :-)
XSS casper test
make the JS test fail
Merge pull request #7 from ivanov/no-html

make the JS test fail
avoid injection in input prompt
Merge pull request #4826 from Carreau/no-html

some $.html( -> $.text(