#XSS is a seri­ous threat — but also a seri­ous pain in the prover­bial when script­ing a JS-client to your own web­ser­vice