I want to say very clearly to not make the mistakes I made. You have seen what happened when you go my route. I care about you and say this with absolute love and want to give you courage. (And I am in a state of total terror and panic as I have court tomorrow, so I get it.)
You should refuse access until a custody agreement is in place. The man is dangerous and your child was traumatized. A two year old isn't "fine" after that -- he is going into defense mode. I don't remember about five years of my childhood -- defense mechanisms are how a child gets through that, but that doesn't make it "fine." You would never let a babysitter take your child for even five minutes who did that. Stop caring what anyone thinks. Your mother in law has eyes and ears. She can choose not to see the truth and there is nothing you can do. My mother in law won't speak to me though I tried to keep our bridges open and she hasn't seen my son, who she adores, in two years. (Watch the news any day to consider how easy it is to have truth in front of you and see it with some other eyes.) You can write them a short kind letter explaining what happened and offering for them to come over to your backyard for a picnic with him, etc.
You should tell H that because he took S overnight without agreement, busted his lip, document the severe emotional distress, diaper rash, etc., you can no longer allow visits without a custody agreement in place, and that there will need to be supervised visits for now. Go to your local domestic abuse counseling center and get the names of social workers who can supervise visits. Get one involved. I do not think overnights are okay based on what you said but I understand why you feel you have to allow them.
When people told me things like that years ago, I would get very upset that they didn't understand my faith and stop coming to the boards. Now I understand that the best way to stand would have been to hold my H to the same standards to which I would hold any man/person. Let him take you to court to argue that after everything you wrote above that he needs full unsupervised access. A judge that punishes you for that? That's cause for an appeal.
Be kind, forgive him daily, hourly. But put very very strict boundaries in place. Protect your son until your H shows that he can do it without supervision.
I believe I will see the bounty of the Lord in the land of the living. Wait for the Lord with courage. Be stouthearted, and wait for the Lord.