updates to XSS protection

Updates to best practices on XSS protection in user console (more user console-specific stuff)