It's a cross-site scripting issue.