[security] Fixed XSS in setup (host parameter), see PMASA-2011-16