FIX #3: CVE-2014-3926: XSS in <title> via "addr" parameter

This code is from 04adc9d3384f1efbb81f8f88a7d1d6871adf2e45
Merge branch 'CVE-2014-3926'