Trusted types & the end of DOM XSS Krzysztof Kotowicz