added notfiy.js (i slightly fucked it up, so it will be vulnerable) . this will be used for XSS2 lesson - reflected XSS