adds spec for link/form hijacking.