Protect web apps from XSS exploits