xss tests (mostly useless)