v basic xss protection for content, still missing for title