ESAPI double encoding validation