fixed issue with xss in autocomplete