closes various XSS vulnerabilities