Could relays have any protections in place for xss attacks? Using random clients that do not sanitize event data is dangerous?