PLUE XSS PoC host. The payload is served from /loader.js.