[Security] add XSS Protection