fix FF pushState after document.open