fix self reflected xss #497