XSS protection by default