Fix two user-assisted cross site scripting attacks.

Thanks to Google Code user timtai1 for notifying us about this
problem!

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@3009 44740490-163a-0410-bde0-09ae8108e29a