https://wp.jochen.hayek.name/blog-en/2010/07/06/noscript-xss-risks-flattr-firefox/