Fix XSS vulnerability that's not really XSS.

Is it really a vulnerability if the only user someone can exploit is themselves?