Several factors contributed to this confusion, including a bug that prevented NoScript from working properly in our test environment and the fact that NoScript provides different levels of XSS protection on same-origin requests and cross-origin requests.