wrapped header in xss filter