xss robustness for extra credit