integrated XSS fix from @hank's fork