Fix theoretical server JavaScript injection exploit