FAIL: cross-site assignment of location.host was allowed.