Security fix

This fixes the evaluation of arbitrary Javascript code in a context where it has permission to make cross-origin requests to any site.