React XSS prevention