Text this: State-Sensitive Black-Box Web Application Scanning for Cross-Site Scripting Vulnerability Detection.