window.name leaks information across domains