should plug all XSS holes, for now