with test for simple xss cass