prevent a possible XSS in facebook and persona providers