now prevents accidental XSS through stupid settings values again