Temporary XSS fixes

See #2780