Add XSS guidelines to readme