new rewrite rule to block  xss attacks