1. A method, in a server, implementing a moving target defense against cross-site scripting, the method comprising: receiving a request for a web page, wherein the server has N versions of the web page each with a mutated version of JavaScript, wherein the mutated version of JavaScript includes changing one or more lexical tokens associated with JavaScript, with the one or more lexical tokens selected based on use in malicious JavaScript attacks, and wherein the one or more lexical tokens are used to manipulate behavior or state in JavaScript; selecting a web page of the N versions; and sending an indication of the mutated version of JavaScript associated with the web page in response to the request.