example: enabling cross-site scripting