XSS fix in usernotes.