better UA payloading logic, added html comment xss testing