add option to allow js in header