Configurable content-sniffing XSS test bed