XSS fixed in params[:sender].

Sender parameter wasn't secured as message. So it was able to insert JS code in sender name and suffer.