eyeOS callback Cross Site Scripting Exploit