[api] Fix change nickname XSS vulnerability.
Merge remote-tracking branch 'origin/master'