adding xss injection attack with an encoded double quote and non-encoded space
support for adding the X-FRAME-OPTIONS header to http responses to partially defeat click-jacking