XSS information updates.

- Equivocate less in the FAQ answer.
- Make doubly sure that they understand which sorts of strings may be
  dangerous in the developer_checklist.

As always, big thanks to @moollaza for proof-reading and
editorial assistance.