xss is delegated sanitizer