Fixed a bug which ignored the XSS settings