first commit, xss and csrf examples