Bug fixes for possible XSS