Removed JavaScript injection vulnerability on additional authentication factor prompt in the JSP, by allowing the value to be escaped.