Protect against XSS in model binding

Fixes #16