SECCON CTF 2014: link to ‘XSS bonsai’ write-up

Closes #271.