[benchaney]

Agreed. Javascript's security model is broken if it allows this. It is just that simple. Blaming services that trust localhost is delusional.