Some input validation and XSS sanitization.
Also, form error handling: we now serve post & signup forms
with the text you entered along with error messages.