Make sure generated tokens are never valid JavaScript

node_modules/c9/uid.js

@@ -8,5 +8,8 @@ module.exports = function(length) {
             .toString("base64")
             .replace(/[^a-zA-Z0-9]/g, "");
     }
-    return uid.slice(0, length);
+    // HACK: make sure unique id is never syntactically valid JavaScript
+    // See http://balpha.de/2013/02/plain-text-considered-harmful-a-cross-domain-exploit/
+    uid = "9c" +uid.slice(0, length - 2);
+    return uid;
 };