Escape user supplied data to prevent XSS

This prevents openid_error from being used an XSS vector. See here for
more details:

http://seclists.org/oss-sec/2014/q2/122
Fix for CVE-2008-4730 - XSS

See here for details:

http://www.securityfocus.com/archive/1/archive/1/496930/100/0/threaded
Fix a potential XSS
XSS Fix

Prevent another XSS; not 100% sure the technique is right, but seems to
work.
htmlspecialchars -> htmlentities, use ENT_QUOTES

Standardize on how I’m doing this at each XSS vector.
Revert XSS fix; seems to break things

Need to revisit this fix; seems to introduce an issue.
Rework fix; this seems to work better in my tests

Prevents an XSS on the URL being requested, which is rebuilt and echoed
in a couple places
Set the HttpOnly flag on cookies
Merge pull request #2 from adamcaudill/master

Security Fixes - XSS Vulnerabilities