Of Course I’ll Let You Execute Arbitrary JavaScript Code in My Users’ Browsers (tech.metriccollective.com)