fixes XSS related to bootstrap popover in recent changes