fix possible XSS in full_message and messageloader