XSS using XHR URL data scheme