title/heading & XSS fix for /edit