p0wned now with XSS (in Firefox)