prevent cross-scripting attacks on 404