Changes from 1.3.4:
* Clean up input validation in 'raw' page output mode which was a potential
  cross-site scripting opportunity.