more XSS fixes