xss improvements