fix minor non persistent XSS