close a possible XSS hole