xss prevention and noscript tags