security fix: passed in window and document in into the plugin namespace for better security