Change destructive actions from GET to POST
Prevent XSS by escaping potential HTML