FIX: escape input of forgot password form before rendering it back to you