No charset is declared on this response. Historically browsers sniffed UTF-7, turning +ADw-script+AD4-alert(document.domain)+ADw-/script+AD4- into a live tag. Modern browsers force UTF-8, so this is a legacy/defence-in-depth lesson - always set <meta charset=utf-8> and a real Content-Type.