Raft of XSS fixes. Includes fixes for webform confirmation pages to prevent js in a webform field from being displayed via webform token replacement. Also includes XSS protections for p2p_cid and p2p_pcid query strings issues. p2p_cid was reported on the personal campaigner registration page.