sanitize. output.
Merge branch 'fix-app-xss' into deploy