Merge branch 'xss-held-messages' into 'master'