This is the `authn_method` from the request parameter, right?  It should be escaped before including in this response.  Otherwise a clever cross-site scripting attack arises wherein I convince your browser to follow a link to validate a bogus or even valid ticket with CAS, specifying a JavaScript-injecting value of `authn_method` on the request.