XSS defense level 1 bypassed