Change volume list on /profile to simple list

This is a little hacky but is a specific requirement and actually seems quite reasonable.
Sanitize many html injections

See #500