added test for XSS at end of url