Bug 3652: close XSS vulnerabilities in opac-export