XSS != Cross-domain policy