fix possible xss by not including a charset