XSS from logged in user fixed