update injection docs
add test for crossdomain scripting