Fixes XSS

[ghost]

Flask documentation states that adding the {{value passing}} to an attribution will prevent some forms of an XSS injection. The documentation explains it better if you want to look into it, here's a link. http://flask.pocoo.org/docs/1.0/security/#x-xss-protection