refs #2174 some more bugfixes and prevent some XSS