went ahead and filled in XSS
added a bunch of wording