fixes a couple of found XSS flaws
Merge pull request #515 from markharding/master

fixes a couple of found XSS flaws