Description:
------------
There is an XSS possibility when using Google Account login and possibly other types of login.

For Google Accounts specifically, setting the "nickname" to the following:


"; alert("hi");</script>


Results in the script being executed on the main login page - I have not tried logging in proper, as I did not want to risk injecting a script into all online users browsers.

I think an input sanitising review may be needed across the entire editor.

Test script:
---------------
"; alert("hi");</script>

Expected result:
----------------
No alert

Actual result:
--------------
hi