Enabled XSS filtering

Also put something in the base_url which will make sure it is changed...