only allow js to run