fix possible xss on 404 page