prevent a possible XSS in facebook and persona providers
Merge pull request #581 from andrvb/xss

prevent a possible XSS in facebook and persona providers