Make sure 'Content-Type: application/json' is sent w/ default result of Dashboard.getAllDashboards controller action and use $.text for untrusted content in three places in dashboard.js.