allowing script with src attr