fixed XSS problems in embed and client