[BUGFIX] Properly escape data in PermissionAjaxController