request targets need a secure default

currently, the standard behavior for request targets enables the application to target any element id it wants. This breaks with the overall philosophy of secure defaults

this behavior should not be allowed unless the environment enables it. This can be done either with the current option -- subtyping ClientRegion -- or with a hook like the dispatch handler