Relax document.domain Attack via frame Attack via new window