web/security: fix mismatching html tags