escape the nonce before setting it as an <input> attribute