Reflected XSS in the create document form if name validation is enabled

Steps to reproduce:

1. Enable name validation (in the administration, go to Editing -> Name strategies and select "Enabled" below "Validate names before saving").
2. Open <xwiki-host>/xwiki/bin/create/Main/%3Cscript%3Ealert%28%27Test%20Test%20Test%20Test%20Test%27%29%3C%2Fscript%3E where <xwiki-host> is the URL of your XWiki installation

Expected result:

No alert is displayed.

Actual result:

An alert with content "Test Test Test Test Test" is displayed.

This demonstrates an XSS vulnerability in the create action.