Fixes #1 - add some rudimentary XSS protections