fixed admin xss restrictions