[seaf] handled 'xss' problem