updated the xss attack to point at our sign in page and password reset page