captive: Fix potential authenticated XSS in title processing