This was originally disabled due to XSS issues, but those XSS issues
have since been resolved upstream with the `strict` security level
setting.

Changelog: fixed