eventemitter + xss + csrf left