The readme states there are XSS vulnerabilities when RETURN_DOM_FRAGMENT is true while RETURN_DOM_IMPORT is false. Out of curiosity, could you give any example(s) of this? And an explanation of why it occurs or why RETURN_DOM_IMPORT prevents it would be appreciated :)