more xss fixes