remove BOM from shortcode param

somehow the javascript interprets the current cursor position as BOM, which you cannot see or hear but it confuses php, e.g. placing the cursor on a param name the returned form has a empty field. Debugging this drove me partially crazy but with help in IRC i got it managed. Thanks @Zauberfish for giving the right hints.

A probably nicer solution would be to strip the BOM out in javascript before sending to the controller...