Allowing cross site scripting from github