updating xss cleaning and enabling csrf