Cross Site Scripting fixes