xss protection, shareable links