Close an XSS hole