web/security: fix html errors