Correct XSS errors reported by Johannes Dahse.