Brakeman fixes

Fixed view and controller security issues
This one defaults to 'edition' and not 'profile' so it would break
`page_path('edition')` with my code would work