enhanced filtering for various parts of ucreate.module

Per http://drupal.org/security-advisory-policy this can be public: requires advanced permissions on non-stable module.

There are a few places using the wrong filter or no filtering which could be improved. See patch for details.