Anything you can do, XSS can do better