Bug 3652: close XSS vulnerabilities on biblionumber and authid