Locked down the XDS functionality

values are hard-coded to try and prevent malicious data being injected.