- fix for bug #3216  (xss vulnerbility found by AppScan)
- fix for bug #3217 (xss vulnerbility found by AppScan, reported by Andrew Helsley)