bad request messages embeded as script