XSS protection wasn't clear

(cherry picked from commit 3cf90f2f7def5b9a6819d0b9514a8ec6dccc8d6d)