re: 3rd party javascript
It would be nice if all 3rd party JS domains needed to be declared in the HTML header, and browsers defaulted to only allowing just the first two (if they have valid certificates), and could be set to any number including zero.