Minor correction to xss.js