XSS and JavaScript – a deadly combination