Add testcase to prove that XSS can break the access token validation.
Quote the access token so it can't break the validation.