fix for WEBSITE-253 - XSS exploit