fix for xss session hijacking vulnerability