FAIL: cross-site assignment of location.hostname was allowed.