https://systw.net/note/archives/1259
DOM XSS to cookie