XSS in streaming avatars

thanks @bkerley and ulf!