protecting apps from cross-origin \`<script>\` tags.