American Express bitten by XSS bugs (again)