fix XSS in nb-suggest #_setText()