XSS test for controller nested inside class