Fix CVE-2013-1742, like in upstream

(XSS) "id" and "sortkey" are not sanitized when editing flag types if categoryAction-foo is set