Security update plus font fix

Host can no longer inject HTML, and OpenSans font is fixed in
shows-style.css