xss enabled for all methods