exceptions for XSS protection