Fix 3025

[nobodyiam]

Which issue(s) this PR fixes:

Fixes #3025

Brief changelog

1. fix potential xss issue
2. add system administrator permission check for user manage and server config page

Follow this checklist to help us incorporate your contribution quickly and easily:

• Read the Contributing Guide before making this pull request.
• Write a pull request description that is detailed enough to understand what the pull request does, how, and why.
• Write necessary unit tests to verify the code.
• Run mvn clean test to make sure this pull request doesn't break anything.

[codecov-io]

Codecov Report

Merging #3037 into master will decrease coverage by 0.03%.
The diff coverage is n/a.

@@             Coverage Diff              @@
##             master    #3037      +/-   ##
============================================
- Coverage     51.29%   51.25%   -0.04%     
+ Complexity     2232     2230       -2     
============================================
  Files           432      432              
  Lines         13382    13382              
  Branches       1374     1374              
============================================
- Hits           6864     6859       -5     
- Misses         6042     6047       +5     
  Partials        476      476              

Impacted Files	Coverage Δ	Complexity Δ
...work/apollo/biz/message/DatabaseMessageSender.java	56.25% <0.00%> (-10.42%)	6.00% <0.00%> (-2.00%)

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update faa0921...031fd6b. Read the comment docs.

[kezhenxu94]

LGTM