getting closer to testing for cookie xss