partial fix #2667

this fixes the ability to replace a space with a /
and skip the XSS filtering