XSS and open redirect on Twitter