Fixed a typo in the XSS msg