themes: Call striptags() on hostname to prevent XSS