References to XSS should be changed to Same Domain Origin Policy