XSS filter, since 0.9.14.