all 4 XSS challenges now solvable
further challenge solution checks

- access control challenges now solvable
- error challenge now not solvable by simple 401 any more
detailed test description
repaired XSS challenges

- fixed URL decoding issue in XSS challenge
- changed required attack to contain " instead of '
added tests for SQL injection