fixed potential XSS in registration form