xss fixes