MOB-2042 XSS protection

this should be unit tested