Fixed allowing for execution of arbitrary Javascript in student response.
ORA-256