hardening against XSS vulns