Ajax XSS fixes