Now permits cross site scripting.