New Zealand Herald falls victim to XSS prank