Pr3759 add refs

This is where rapid7#3782 was supposed to go. Sorry about that.

See that the refs and the description display properly:

````
       Name: Android Open Source Platform (AOSP) Browser UXSS
     Module: auxiliary/gather/android_stock_browser_uxss
    License: Metasploit Framework License (BSD)
       Rank: Normal

Provided by:
  Rafay Baloch
  joev <joev@metasploit.com>

Basic options:
  Name         Current Setting     Required  Description
  ----         ---------------     --------  -----------
  BYPASS_XFO   false               no        Bypass URLs that have X-Frame-Options by using a one-click popup exploit.
  CLOSE_POPUP  true                no        When BYPASS_XFO is enabled, this closes the popup window after exfiltration.
  CUSTOM_JS                        no        A string of javascript to execute in the context of the target URLs.
  SRVHOST      192.168.43.169      yes       The local host to listen on. This must be an address on the local machine or 0.0.0.0
  SRVPORT      8080                yes       The local port to listen on.
  SSL          false               no        Negotiate SSL for incoming connections
  SSLCert                          no        Path to a custom SSL certificate (default is randomly generated)
  SSLVersion   SSL3                no        Specify the version of SSL that should be used (accepted: SSL2, SSL3, TLS1)
  TARGET_URLS  http://example.com  yes       The comma-separated list of URLs to steal.
  URIPATH      c01                 no        The URI to use for this exploit (default is random)

Description:
  This module exploits a Universal Cross-Site Scripting (UXSS) 
  vulnerability present in all versions of Android's open source stock 
  browser before Android 4.4. If successful, an attacker can leverage 
  this bug to scrape both cookie data and page contents from a 
  vulnerable browser window. If your target URLs use X-Frame-Options, 
  you can enable the "BYPASS_XFO" option, which will cause a popup 
  window to be used. This requires a click from the user and is much 
  less stealthy, but is generally harmless-looking. By supplying a 
  CUSTOM_JS paramter and ensuring CLOSE_POPUP is set to false, this 
  module also allows running aribrary javascript in the context of the 
  targeted URL. Some sample UXSS scripts are provided in 
  data/exploits/uxss.

References:
  http://1337day.com/exploit/description/22581
  http://www.osvdb.org/110664
  http://cvedetails.com/cve/2014-6041/
````

If you hate the name, @jvennix-r7 let me know.