Maybe I am not up to date on my browser threats, but exactly how much damage can a website without JavaScript do? The most I can think of is cross-site form requests and cookie shenanigans, but that is a problem primarily solved by web hosts, not browser providers.