I'm wondering if it makes sense to split this and the `_isSafeMethod`, `_isSafePath` and `_isSameOrigin` functions out into an `oae-util/security.js` file