Refine checking for include.js host some more
Escape email address to prevent XSS