XSS protection by default.