Is there a standard way to avoid attacks based on abusing your window.location.replace() calls?