Brakeman fixes

Fixed view and controller security issues
I know that we don't always use profile as the default path. for the sake of making this more ambiguous you should do

```
def page_path(default)
  page = (params[:page] || default).parameterize('_')
```