update readme for xss fix