JS: securing globals