better xss mitigation