FAIL: cross-site assignment of location.pathname was allowed.