security options

• can cancel egress request based on htmx:validateUrl event2ms ‣

  this.timeout(4000)
  htmx.config.selfRequestsOnly = false
  // should trigger send error, rather than reject
  var pathVerifier = htmx.on('htmx:validateUrl', function(evt) {
    evt.preventDefault()
  })
  var listener = htmx.on('htmx:invalidPath', function() {
    htmx.off('htmx:invalidPath', listener)
    htmx.off('htmx:validateUrl', pathVerifier)
    done()
  })
  this.server.restore() // use real xhrs
  // will 404, but should respond
  var btn = make('<button hx-get="https://hypermedia.systems/www/test">Initial</button>')
  btn.click()
  htmx.config.selfRequestsOnly = true