small REST addition
add hint about xss security