XSS fixes