added test for script injection to custom middlewares