NXIO-316 add CDATA to protect JSF from JS