XSS through `__e2e_action_id` delivered by JSONP

The `__e2e_action_id` params used with POST requests to `/server_call_POST?_m=*` endpoint is not properly escaped when reflected back on a response allowing to inject Javascript. Also, another issue on some methods (such as `/server_call_POST?_m=edit`) allows - with a *strong* premise discussed on …

curl 'https://www.quora.com/webnode2/server_call_POST?_v=####&_m=load_menu'  
-data 'json=...&__e2e_action_id=esko02tjqe&...'

> POST /webnode2/server_call_POST?_v=█████&_m=load_menu HTTP/1.1
> Host: www.quora.com
> Cookie: █████████████████████
...
< HTTP/1.1 200 OK
< Content-Type: …