cross domain script blocking should be enforceable in all browsers