SECURITY: self XSS by admin by editing badge name