XSS found by Protector.