security: <a target=_blank> does not contain rel="noopener noreferrer"

[Ondřej Kupka]

This needs to be added to any user-generated content, otherwise there is a security risk as explained here:

https://mathiasbynens.github.io/rel-noopener/

Kudos to noisy for reporting the issue.

[Ondřej Kupka]

Fixed.