Add a very basic JS injection attack document & test