Facebook: XSS / CSRF worms on the social network