[WEB] Under Construction

[Crafty]

XSS is client side. You do not need to hijack an account…
So imo, XSS or any others clientside attacks are irrevelant here.