fixing xss vulnerability in new client.