Filter request parameters at servlets against XSS