Fix typeahead xss bug