fix race condition w/ attribute override; disable embedding css in secure mode