much better method for xss protection on every request.