Persistent XSS vulnerability in saveNewUser form fix