Security settings are actually blocking this.  We may not be able to block the user leaving the page unless we further block the default behavior of all links.