fixed some xss issues