[#7560] ticket:630 Avoid anonymous permissions for private tickets
[#7560] better HTML construction to avoid injection attacks, in case error message might have user-entered text