Some XSS fixes