tightened some XSS potential weakpoints