changes for xss and security fixes.