improve xss prevention on request body