closes #3881

src/middleware/render.js

@@ -32,6 +32,7 @@ module.exports = function(middleware) {
 			options.bodyClass = buildBodyClass(req);
 
 			res.locals.template = template;
+			options._locals = undefined;
 
 			if (res.locals.isAPI) {
 				if (req.route && req.route.path === '/api/') {
@@ -52,6 +53,8 @@ module.exports = function(middleware) {
 					return fn(err);
 				}
 
+				ajaxifyData = ajaxifyData.replace(/<\//g, '<\\/');
+
 				str = str + '<script id="ajaxify-data" type="application/json">' + ajaxifyData + '</script>';
 
 				str = (res.locals.postHeader ? res.locals.postHeader : '') + str + (res.locals.preFooter ? res.locals.preFooter : '');