Scoping by URL
EXCLUDE and URL_CONFIG both match
location.href. This page reads the query string: the baseline allows a handful of
tags, ?strict swaps in a tighter config for this URL only, and ?off
excludes the page entirely.
Same payload, sanitized by whatever config applies here
Resulting HTML: