typo correction protocal -> protocol
added psot regarding javascript injection attack