fixed XSS bugs