What ABE rules do you have? The built-in rule shouldn't apply to this. You'd have to have some fairly restrictive ABE rules (similar to RequestPolicy) to cause trouble.
You certainly should take a careful look at the regular script-blocking whenever you're going to do something sensitive.
You certainly should take a careful look at the regular script-blocking whenever you're going to do something sensitive.