Add note on XSS.