updates to disable cross-site scripting alerts