add in XSS prevention so it errors out instead