Bug 1092066: Prevent javascript links in cartridges