Facebook's warning against socially-engineered XSS is neat. It's a shame it's necessary though.