Externalizing event handlers works but is not fully secured, yet.