fix: example of xss in bad context using a dedicated profile field

[lirantal]

Why this PR

The example of using proper context to perform output encoding is incorrect in terms of bad code, and example reference:

• bad code: line 26 of profile.js referenced a doc.doc.firstName.. but doc.doc is incorrect and never really did work anyway. Also the firstNameSafeString template variable in the view at profile.html was never assigned.
• example reference: the example relied on the firstName with an attempt to first encode it, and then the FIXME hint to encode it properly for HTML but the problem is that even if you encode it (either way), it still causes an XSS because other views use it, such as the drop-down profile name etc.

This change

This PR fixes the issue by introducing another profile field website that is never used anywhere, and can be mitigated easily with encoding, but if done improperly can still introduce an XSS, and the FIXME clause of proper context encoding then makes sense.

[UlisesGascon]

Looks great @lirantal! Just update the broken test and we fix the tests 💪

[lirantal]

Thanks!