[ChuckMcM]

I would say disable flash/javascript by default but I too was surprised they didn't have this. Nothing like knowing you shouldn't click on a link only to have some malicious javascript do it for you.