README: update `remove-xss` link.