Correct XSS in ajax completion dropdowns for users