[merb]

well it depends an administrator of an org can actually inject javascript without intercepting the http response stream.