Well, if he's like me, he has it selectively enabled/whitelisted for trusted sites (NoScript or Chrome's JS settings).