being more careful with javascript_notifier and non-public requests

closes #238