added example for Ajax XXE attack.