Added an echo page for a minimal reflected XSS demo.
Updated server to support the new echo URL
Disable chrome's XSS auditor to allow demoing non-obfuscated reflected XSS