Fixed bug #14215: XSS in beuser (thanks to Georg Ringer)