Using Cross-Site Scripting to bypass CSRF protections