I'm impressed this is possible in pure CSS. What implications does this have for security/privacy? Should I be blocking CSS in addition to JS now just in case?