Added note on xss possibility