added xss mitigation