prevent xss for sign up and update account