add xss check field by default to all forms