fixes a couple of found XSS flaws