httponly cookie headers, x-frame-options header.. amazing how many things we *need* the browsers to fix in the core security models