Fix for XSS

Wrap El expression with JSTL c:out tag, so that the page could escape the script tags.