closes #10 prevent form xss