http xss check testcase