couldn't this be a major security issue since you could integrate your own js to any url on the domain?