Add untested support for enabling cross site scripting