Apply patch from upstream for cross-site scripting vulnerability

PR: 209841
Reported by: Vladimir Krstulja <vlad-fbsd@acheronmedia.com>
Approved by: maintainer timeout (2 weeks)
Security: CVE-2016-5103
Security: https://vuxml.FreeBSD.org/freebsd/97e86d10-2ea7-11e6-ae88-002590263bf5.html
MFH: 2016Q2