Expandable ads can be entry points for site hacks