Exploiting stored XSS using the header