Use empty name to inject JS to avoid revealing code.

updated patch for #799