fix XSS in nb-suggest #setSource()