Close the XSS holes and add todo for config