Fix some xss holes