NEW: Sanitise task name in runTask

The task name is not sanitised so if you submit something like 
```
<your_site>/dev/tasks/<img+src=aa+onerror=alert(1)>
```
it will be output to the browser