Echo JS 0.11.0

This is cool as an excersice or for some tricky edge-cases. But the standard way of blocking script is this
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src