Xss security configuration