Preventing and mitigating Cross-Site Scripting