Fix more XSS, cleaned up a bit