disable external script to aviod XSS