Add XSecurity to remove XSS.