More XSS fixes