Cross-Site Scripting: Ep.6 – Further Exploitation

I have done the following so far:

1. Identify the wildcard cycles employee user ID & token
2. Host the http server using the python module (port 8080)
3. Create a script.js file w/ the code provided in the Briefing section w/ the XMLHttpRequest object's open method's url parameter set to /admin/token instead of /users/data (tried setting this many different things including http://{ip of employee machine}/admin/token, /{employee id}/{token} - 
4. All the while having the nc -vnlp 5555 looping in an infinite while loop

On the terminal monitoring the http server activity, I see a GET /script.js every ~60s or so, and each time that happens, the nc listening on 5555 shows the same keepalive traffic w/ the same user ID & token information, but not the contents of the actual /admin/token page... 

I have a feeling I am missing something in item 3 listed above - something not right w/ how i have the script.js payload set up... 

Been stuck on this for way longer than I care to, any guidance would be greatly appreciated.