Refactorings to header module

* Made showError and showSuccess safe by default by only allowing
  raw html output for message objects
* Refactor event handlers to not use jQuery.find
* Added a todo about direct DOM access

Change-Id: Iad61af3f1b55b0f45353df36f20734ac3088cbb5
Merge "Refactorings to header module"