fixed xss bug in DropDownListNoPost widget.