drop remove xss the whole idea is bullshit