1. A method, in a client device, using a moving target defense against cross-site scripting, the method comprising: requesting a web page from a server, wherein the server mutates web content with JavaScript offline to provide N versions of the web page, each with a different mutated version of JavaScript, and wherein, upon the requesting, the server provides one of the N versions of the web page thereby providing the moving target defense against cross-site scripting; receiving a response serving the web page from the server with a header comprising an indication of a mutated version of JavaScript for the web page of the N versions of the web page each with a different mutated version and replaced randomly to increase probability of vulnerability detection, wherein the mutated version of JavaScript comprises changes to one or more lexical tokens which are selected based on use in malicious JavaScript attacks, wherein the one or more lexical tokens are one or more of a left parenthesis and an assignment operator, wherein cross-site scripting requires use of the parenthesis or the assignment operator to maliciously manipulate behavior, and wherein the parenthesis or the assignment operator are randomized because they manipulate behavior or state in a cross-site scripting attack; adjusting a JavaScript interpreter based on the mutated version of JavaScript for the web page; and detecting any JavaScript not conforming to the mutated version of JavaScript and providing an indication of a violation including JavaScript not conforming to the mutated version of JavaScript associated with the web page, wherein the indication includes a page on which the violation occurred, the page's referrer, a resource that violated the page's policy, and a specific directive of the violation.