reflected XSS is now done through flash messages.