Assignment of window.location to variable (loc) flagged as XSS vulnerability 

Assignment of window.location to variable 'loc' and it's subsequent usage was flagged as a potential XSS vulnerability in a recent site penetration test; although not a true vulnerability due to the regex safety net.

I have removed the assignment and updated references accordingly.