Restricting accessible uris for script at first look looks like an very
good feature but in reality it cripples scripts ability and adds no
additional security because if we use https and signatures then there
should be no worry about script badness. And if it's then this is just
small garden wall anyone exploiting https and signatures could go
around just by using same https exploit again and again so this really
doesn't make any sense.