xss cleanup logic fixes