securing JavaScript