only this is needed, the other is actually an XSS risk