Security: prevent XSS issues

Improve security against potential XSS type of attacks:

* encode output strings properly in html, javascript, json or html attribute values
* validate user input for values used in page or persisted