Make note that xss is ok