XSS FIXES