I assume we have an XSS test somewhere?