was about to post the same. Request policy + noscript ftw