fixed a silly XSS issue :D