https://toxigon.com/understanding-javascript-security