was able to inject script via the username

https://github.com/comntr/http-server/blob/master/src/handle...