Anti XSS fixes