Expert review of modern XSS guidance: what it gets right, where it misleads, and the practical defenses developers should use in 2026.