fix(security): theme selection via dom input without validation (#629)

fix(security): theme selection via dom input without validation (#629) #243