ERB::Util.h doesn't escape apostrophes and slash.
Rack::Utils.escape_html is more performant and also escapes all char recommended by OWASP. (https://github.com/rack/rack/issues/27)
- Pull out helpers into separate module
- Fix i18n strings to be loaded once, not every request
- Clearer separation between default and custom tabs
- Fix action redirects to contain the query string from the referrer so we don't lose our context upon redirect.