maybe it isn't so smart to execute script tags in the client, mmm?