SparkDevNetwork/Rock — pull request #595 by treyhendon (2014-10-22 19:57:35+00:00)
Title: Fix XSS Bug, Issue #563

Set the form action to be "/" so that non-escaped text is not present in
the action param. The default 404 handler page was not passing XSS tests. By hard setting the form1.Action to be "/" it now passes a XSS test. Issue #563