Fix cross-site scripting by AJAX post request when adding new review