Testing for AJAX Vulnerabilities