Remove unsafe location.href setting