xss bug reported by Drew Callahan