I don't disable JS but block all 3rd party requests by default. This also blocks all scripts loaded not from current domain.