More XSS fixes related to magicHtml