That checks out with the lucky one i did on badges.page with a low nonce

javascript is not the way to go