fix XSS vulnerability in conversations#new, closes #4010