Fix still more XSS