Fixes major security exploit regarding JavaScript injection.

Fixes #1957

No idea why this took 3 months.  I'll blame myself.