user <html><script>alert(document.cookie)</script></html> quit