non bypassable XSS Filter