Endpoints should not be vulnerable to reflected cross site scripting xss attacks