Giorgio fixed the `javascript` behavior on the medium level for us (in NoScript 2.9.5.3). We should include tests in our test suite to check that: 1) `javascript:` URIs on websites loaded over HTTPS work 2) `javascript:` URIs embedded on websites loaded over HTTP do not work.