Fix XSS live rendering hole

See #651.