Updated XSS demo to show content exfiltration