XSS protection wasn't clear