more XSS fixes
Merge branch 'hotfixes' into develop