Update js: no script-injected js, only async