Comment by egberts1

But it does nothing to prevent JS in its payload.