Close the XSS holes and add todo for config
Merge pull request #2 from larowlan/7.x-1.x

Close the XSS holes and add todo for config