Fixed the most obvious XSS vulnerability issues in WebBasket.  Beware, in the message display, the "final_body" now gets fully escaped, which results in an impossibility to format messages in HTML.  For a less-severe approach, only known vulnerable tags (such as PLAINTEXT, SCRIPT, etc) could be removed; or, even better, only pre-defined whitelisted tags (such as STRONG, EM, P, BR) could be allowed. Currently no HTML is interpreted at all.
Fixed the most obvious XSS vulnerability issues in WebBasket.  Beware,
in the message display, the "final_body" now gets fully escaped, which
results in an impossibility to format messages in HTML.  For a
less-severe approach, only known vulnerable tags (such as PLAINTEXT,
SCRIPT, etc) could be removed; or, even better, only pre-defined
whitelisted tags (such as STRONG, EM, P, BR) could be allowed.
Currently no HTML is interpreted at all.

inveniosoftware/invenio,inveniosoftware/invenio,tiborsimko/invenio,tiborsimko/invenio