(security/core#67) Port APIv3's escaping scheme to APIv4