XSS is not a feature