security options

• can disable script tag support with htmx.config.allowScriptTags7ms ‣

  var globalWasCalled = false
  window.callGlobal = function() {
    globalWasCalled = true
  }
  try {
    htmx.config.allowScriptTags = false
    this.server.respondWith('GET', '/test', '<div><script>callGlobal()</script></div>')
    var div = make("<div hx-get='/test'></div>")
    div.click()
    this.server.respond()
    globalWasCalled.should.equal(false)
  } finally {
    htmx.config.allowScriptTags = true
    delete window.callGlobal
  }