fix for #497

xss fixes