Defending against JavaScript phishing