XSS improvements