Fix XSS Bug, Issue #563

Set the form action to be "/" so that non-escaped text is not present in
the action param.  The default 404 handler page was not passing XSS tests.  By hard setting the form1.Action to be "/" it now passes a XSS test.  Issue #563