You might also consider setting Content-Security-Policy headers to enforce your intent. http://content-security-policy.com/