security fixes: sending email with escaped text