Mark-of-the-Web bypass