missing check for JavaScript in client response for String (Java) vs.