fixing DOM based xss