Fix several XSS vulnerabilities

In both the client and staff interfaces, where the URL and request
parameters were echo'd back without any escaping
Fix XSS vulnerability in phone number fields
Fix XSS vulnerability in account registration