[security] make sure data sent to user never exceed 160 chars