use c:out instead of bare references to avoid potential xss problems