added a temp. XSS oracle for simon's demo