evaluate script tags - probably needs to be some kind of option for untrusted sites - also fire off a custom event
set request header