Can an HTML <script> fragment on the URL be used for XSS in a purely client side application?