an example app that collects cookies via ajax requests from XSS attacks