Thomas would you mind expounding a bit or posting a link about the 'content-aware neutralization' approach to solving XSS? I know that Rails 3 HTML-encodes all output by default, but how would this approach fix XSS vulnerabilities using pure Javascript payloads rather than the typical approach of embedding JS in a <script> or another HTML tag?