[Fix] prevent malicious user from injecting arbitrary js code in pp's envisaged_journal field.

mentioned in issue #245