https://ma.tt/2005/08/ajax-and-xss/