XSS protection for XSRF cookies