CHANGES: Add is_xss mention in CHANGES.