Sony sanitize bootstrap data

Does an escape/unescape around the bootstrapping process to prevent XSS.
This seems to repeat code in `deepEscape` that should be extracted.