For my own sake I'd add to that list that they should make disclose every 3rd party site they'll need to load scripts from or at the very least include those early in the process. I'm not allowing JavaScript to run from anywhere if it isn't 100% necessary for exactly what I want to accomplish. Filling out a form only to have it fail because suddenly the website wants to run code from another domain is annoying, and each allow/refresh is an opportunity for badly designed websites to screw up my order or charge me multiple times. I do realize that most customers aren't selectively allowing/rejecting scripts, but its been a highly recommended practice for decades now.