be more careful about preventing xss attacks, re http://bugs.debian.org/659899