[lgas]

There don't even have to be scripts being served -- as long as HTML is being served over HTTP they can inject their own scripts.