Our Favorite XSS Filters and How to Attack Them