Fixed XSS for case names via URL hashes