This would make scripting attacks really hard to defend against. They could use something along the lines of Caja, but it's a really hard problem in general (an

This would make scripting attacks really hard to defend against. They could use something along the lines of Caja, but it's a really hard problem in general (and one they're worrying about, given the gh-pages move to a separate domain)