Props to @greggles for the clickjacking disclosure