DOC: Comment re: XSS, PEP8 imports, typo