ok, add some basic security around sending javascript to everyone so you can't totally pwn other people's browsers with this