And to add insult to injury, the twitter mobile site seems to be hax0red. there's an alert("xss"); on it as I write this.