add xss rules