XssInput expanded with except() and only()