diff --git a/app/controllers/payments_controller.rb b/app/controllers/payments_controller.rb
index 8faebef7..322ed397 100644
--- a/app/controllers/payments_controller.rb
+++ b/app/controllers/payments_controller.rb
@@ -3,7 +3,6 @@ class PaymentsController < ApplicationController
   load_and_authorize_resource
   load_resource :conference, find_by: :short_title
   authorize_resource :conference_registrations, class: Registration
-  before_action :check_amount, only: [:new]
 
   def index
     @payments = current_user.payments
@@ -11,6 +10,9 @@ class PaymentsController < ApplicationController
 
   def new
     @total_amount_to_pay = Ticket.total_price(@conference, current_user, paid: false)
+    if @total_amount_to_pay.zero?
+      raise CanCan::AccessDenied.new('Nothing to pay for!', :new, Payment)
+    end
     @unpaid_ticket_purchases = current_user.ticket_purchases.unpaid.by_conference(@conference)
   end
 
@@ -29,11 +31,6 @@ class PaymentsController < ApplicationController
     end
   end
 
-  def check_amount
-    @total_amount_to_pay = Ticket.total_price(@conference, current_user, paid: false)
-    redirect_to root_path if @total_amount_to_pay.zero?
-  end
-
   private
 
   def payment_params
diff --git a/app/views/admin/events/_nested_comments.html.haml b/app/views/admin/events/_nested_comments.html.haml
index 8ab3cabb..0bfb440c 100644
--- a/app/views/admin/events/_nested_comments.html.haml
+++ b/app/views/admin/events/_nested_comments.html.haml
@@ -6,9 +6,9 @@
     %div
       %a.pull-right.comment-reply-link{ href: '#' } Reply
       .comment-reply
-        = semantic_form_for :comment, url: '#{comment_admin_conference_program_event_path(@conference.short_title, comment.commentable_id)}', method: :post do |f|
+        = semantic_form_for :comment, url: comment_admin_conference_program_event_path(@conference.short_title, comment.commentable_id), method: :post do |f|
           = f.input :body
-          %input{ name: 'parent', type: 'hidden', value: '#{comment.id}' }
+          %input{ name: 'parent', type: 'hidden', value: comment.id }
           %input{ name: 'authenticity_token', type: 'hidden', value: '#{form_authenticity_token}' }
           %button.btn.btn-primary.pull-right{ name: 'button', type: 'submit' } Add Reply
   - comment.children.each do |child|
diff --git a/app/views/admin/events/index.html.haml b/app/views/admin/events/index.html.haml
index 50d7acd5..f8b58b63 100644
--- a/app/views/admin/events/index.html.haml
+++ b/app/views/admin/events/index.html.haml
@@ -9,13 +9,14 @@
             =link_to 'Add Event', new_admin_conference_program_event_path(@conference.short_title), class: 'button btn btn-default btn-info'
           - if can? :read, Event
             .btn-group
-              %button.btn.btn-default.dropdown-toggle{ 'data-toggle' => 'dropdown', type: 'button', class: 'btn btn-success' }
-                Export PDF
-                %span.caret
-              %ul.dropdown-menu{ role: 'menu' }
-                %li= link_to 'All Events', admin_conference_program_events_path(@conference.short_title, format: :pdf, event_export_option: 'all')
-                %li= link_to 'Confirmed Events', admin_conference_program_events_path(@conference.short_title, format: :pdf, event_export_option: 'confirmed')
-                %li= link_to 'All Events with Comments', admin_conference_program_events_path(@conference.short_title, format: :pdf, event_export_option: 'all_with_comments')
+              .btn-group
+                %button.btn.btn-default.dropdown-toggle{ 'data-toggle' => 'dropdown', type: 'button', class: 'btn btn-success' }
+                  Export PDF
+                  %span.caret
+                %ul.dropdown-menu{ role: 'menu' }
+                  %li= link_to 'All Events', admin_conference_program_events_path(@conference.short_title, format: :pdf, event_export_option: 'all')
+                  %li= link_to 'Confirmed Events', admin_conference_program_events_path(@conference.short_title, format: :pdf, event_export_option: 'confirmed')
+                  %li= link_to 'All Events with Comments', admin_conference_program_events_path(@conference.short_title, format: :pdf, event_export_option: 'all_with_comments')
               .btn-group
                 %button.btn.btn-default.dropdown-toggle{ 'data-toggle' => 'dropdown', type: 'button', class: 'btn btn-success' }
                   Export CSV
diff --git a/app/views/conferences/_venue.html.haml b/app/views/conferences/_venue.html.haml
index 62af90c7..4436b0fe 100644
--- a/app/views/conferences/_venue.html.haml
+++ b/app/views/conferences/_venue.html.haml
@@ -32,4 +32,4 @@
           = @conference.venue.country_name
           - if @conference.venue.website
             %br
-            =link_to @conference.venue.website, @conference.venue.website
+            =link_to(h(@conference.venue.website), h(@conference.venue.website)).html_safe
diff --git a/app/views/conferences/_venue_map.html.haml b/app/views/conferences/_venue_map.html.haml
index b58b3053..717069d5 100644
--- a/app/views/conferences/_venue_map.html.haml
+++ b/app/views/conferences/_venue_map.html.haml
@@ -3,15 +3,15 @@
 - content_for(:script_body) do
   :javascript
     // create a map in the "map" div, set the view to a given place and zoom
-    var map = L.map('map', { scrollWheelZoom: false }).setView([#{@conference.venue.latitude}, #{@conference.venue.longitude}], 11);
+    var map = L.map('map', { scrollWheelZoom: false }).setView([#{h(@conference.venue.latitude)}, #{h(@conference.venue.longitude)}], 11);
     // add an OpenStreetMap tile layer
     L.tileLayer('//{s}.tile.openstreetmap.org/{z}/{x}/{y}.png', {
       attribution: 'Map data &copy; <a href="http://openstreetmap.org">OpenStreetMap</a> contributors, <a href="http://creativecommons.org/licenses/by-sa/2.0/">CC-BY-SA</a>, Imagery © <a href="http://mapbox.com">Mapbox</a>',
       maxZoom: 18
     }).addTo(map);
     // add a marker in the given location, attach some popup content to it and open the popup
-    L.marker([#{@conference.venue.latitude}, #{@conference.venue.longitude}]).addTo(map)
-      .bindPopup("#{popup}")
+    L.marker([#{h(@conference.venue.latitude)}, #{h(@conference.venue.longitude)}]).addTo(map)
+      .bindPopup("#{h(popup)}")
       .openPopup();
     // Turn scrollwheel on when user clicks
     map.on('focus', function(e) {
diff --git a/app/views/conferences/show.html.haml b/app/views/conferences/show.html.haml
index f94b8ee4..dd6b2d62 100644
--- a/app/views/conferences/show.html.haml
+++ b/app/views/conferences/show.html.haml
@@ -82,7 +82,7 @@
 
 - content_for :script_head do
   :javascript
-    var triangle_tcs = tinycolor("#{@conference.color}").monochromatic();
+    var triangle_tcs = tinycolor("#{h(@conference.color)}").monochromatic();
     var triangle_colors = triangle_tcs.map(function(t) { return t.toHexString(); });
     $(function () {
       $(document).ready(function() {
diff --git a/spec/features/tracks_spec.rb b/spec/features/tracks_spec.rb
index 934f28ba..f753abc2 100644
--- a/spec/features/tracks_spec.rb
+++ b/spec/features/tracks_spec.rb
@@ -36,8 +36,11 @@ feature Track do
 
       expected = expect do
         visit admin_conference_program_tracks_path(conference_id: conference.short_title)
-
-        click_link 'Delete'
+        within('#tracks', visible: true) do
+          page.accept_confirm do
+            find_link('Delete').click
+          end
+        end
       end
 
       expected.to change { Track.count }.by(-1)
@@ -53,7 +56,9 @@ feature Track do
 
       expected = expect do
         visit admin_conference_program_tracks_path(conference_id: conference.short_title)
-        click_link 'Edit'
+        within('#tracks', visible: true) do
+          find_link('Edit').trigger('click')
+        end
 
         fill_in 'track_name', with: 'Distribution'
         fill_in 'track_short_name', with: 'Distribution'
diff --git a/spec/spec_helper.rb b/spec/spec_helper.rb
index fc56e829..d9283117 100644
--- a/spec/spec_helper.rb
+++ b/spec/spec_helper.rb
@@ -59,7 +59,7 @@ RSpec.configure do |config|
   Capybara.javascript_driver = :poltergeist
 
   Capybara.register_driver :poltergeist do |app|
-    Capybara::Poltergeist::Driver.new(app, phantomjs: Phantomjs.path, js_errors: false)
+    Capybara::Poltergeist::Driver.new(app, phantomjs: Phantomjs.path, js_errors: false, window_size: [1920, 1080])
   end
 
   # Includes helpers and connect them to specific types of tests
@@ -82,6 +82,14 @@ RSpec.configure do |config|
   # Types of tests (controller, feature, model) will
   # be inferred from subfolder name
   config.infer_spec_type_from_file_location!
+
+  # Enable this if you like to see what you're debugging
+  # config.after(:example) do |example|
+  #   if example.exception
+  #     save_and_open_screenshot
+  #     save_and_open_page
+  #   end
+  # end
 end
 
 OmniAuth.config.test_mode = true