Update cross-site-scripting.md