disable external script to aviod XSS
..