* xss check moved to Helpers extension.