bugfix for flash xss attack