fixed some potential xss exploits