fixed xss bug when rendering 'key' ajax param.
Merge branch 'feature/security' into develop