a start on XSS prevention, #121