care less about all the html generated by the version controller, just look for the important stuff
check for the absence of a successful XSS-attack rather than the means to avoid it