Fix XSS in user signup