fixing xss, fixes #566

It's kind of funny because at my job all I do is find vulnerabilities. I never actually get to fix them. I'm used to breaking things, not making them.