xss bookmarklet: changed JS to an alert, updated with comments