Added note about XSS protection.