Cross-site scripting in public API in github.com/rancher/norman