Mention XSS.

That isn't the best explanation I've ever written.  But people reading this
should already know about these, so I guess it's ok.