XSS fixed in params[:sender].