temporarily patched XSS security hole