fix XSS in stats.js