Fix the XSS fix, see #38, #39, #40.