There are programs like DisplayFusion which take care of scrolling in non-focused windows. I highly recommend it, although it is paid after a while. There must be other tools out there that can do it!
If you ask me, a layout language should have simple orthogonal concepts in it. The reason CSS gets so much hate is, in my opinion, a lack of coherence, a lack of modularity and terrible naming choices.
You only have to look at vertical centering to see the problem. Situations that look almost the same require entirely different solutions, often causing a change to ripple through to parent/child/sibling elements.
Isn't XSS only a client side danger? For URLs, this is relevant since you can post a malicious link and people can click on it. It's much harder to get someone else's browser to accept a cookie you made for a specific website.
Of course, cookies are still client-side data and should not be trusted. But XSS is not a problem here. Correct me if I'm wrong.