hide javascript code from client