fixed xss vulnerability
see https://github.com/alohaeditor/Aloha-Editor/issues/1270