catch xss on the template side also