BZ-1029272 - Security review: reflected XSS in dashboard