Fix turbolinks with element id's; test for xss attacks