Don't report immediate XSS dupes as weak warnings

I'm certain I've made this same mistake in the past.

Combined with #354 this will cut down a lot on duplicate XSS warnings.