add xss protection