XSS fix -- thanks @dahlukeh