fix history xss