fix xss exploit on cookies[:lang]