[skybrian]

The latter. It's for guarding against malicious JavaScript discovering secrets. In practice, the browser should have this sort of protection built in.