Leko says to YSITD ... modifying the DOM “environment” in the victim’s browser used by the original client side script