Defects

Missing ;  extra ;;   Follow some of the standards outlined by Crowford
He points to a really good use case why to have { on the same line as the if
http://javascript.crockford.com/code.html

What happens is by not having if(x===y) {
you risk the Javscript vm to inset a ; which can then cause other issues 

AND

Clickjacking attack allows to perform an action on victim site on visitor’s behalf.

All modern browsers support the X-Frame-Options header.

The header allows or disallows rendering of the document when inside an iframe.

It may have two possible values:

SAMEORIGIN
The document will be rendered (shown) in an frame only if the frame and it’s parent have the same origin.
DENY
The document may not be rendered inside a frame.
Browsers ignore the header if speicified in the META tag. So the following META will be ignored: