Fixed XSS issue

Also the document click handler wasn't being removed correctly - fixed that too