Close the XSS holes and add todo for config

Fixes for #1
Yes jQuery colorpicker will only input valid hex colors, but turn of JavaScript and you can submit whatever you like.