Added protection for session hijacking over XSS