Should XSS stay or should it go?