lab 2: now with xss