fix xss cookie