fixed potential xss issue when one of the possible values for the autocomplete contains an html string
Merge pull request #79 from KaeruCT/master

Script injection fix