Added failing test to show XSS vuln

Added a failing test to show how it doesn't encode the value when used in a form value.

My first PR for years and on Nancy. Please don't kill me ;-)