HTML injection on Hipchat login page (SEC-828)