adding a whole lot of xss fixes