diff --git a/maps/tests/iframe.html b/maps/tests/iframe.html
index f3d48a77..038874b6 100644
--- a/maps/tests/iframe.html
+++ b/maps/tests/iframe.html
@@ -1,12 +1,11 @@
 <!doctype html>
 <html lang="en">
     <head>
-
         <script>
             var script = document.createElement('script');
+            // Don't do this at home kids! The "document.referrer" part is actually inserting a XSS security.
+            // We are OK in this precise case because the HTML page is hosted on the "maps" domain that contains only static files.
             script.setAttribute('src', document.referrer + 'iframe_api.js');
-            script.defer = false;
-            script.async = false;
             document.head.appendChild(script);
         </script>
     </head>
