app: fix XSS
app: fix XSS

build.golang.org does't use any cookies or allow any non-read actions,
but fix anyway.

Change-Id: Ib9002753de268083d7e16ce41cd7ff950f7f28a4
Reviewed-on: https://go-review.googlesource.com/47091
Reviewed-by: Chris Broadfoot <0c2851a4f8ab4aa5606e69c0757771dd13dbe686@golang.org>

golang/build,golang/build,golang/build,golang/build