getting closer to cookie xss detection...