SECURITY: fix XSS using fancy mention hack