Status Message is vulnerable to reflected XSS #1148

this fixed #1148 

Some other test case failures are not caused by this patch,
But I'll look into them after they fix the hardcoded user account