I have found it... I added a SSL trust logo on the welcoming page, and it has a script:
<script language="javascript" type="text/javascript">
//<![CDATA[
var tl_loc0=(window.location.protocol == "https:")? "https://secure.comodo.net/trustlogo/javascript/trustlogo.js" :
"http://www.trustlogo.com/trustlogo/javascript/trustlogo.js";
document.writeln('<scr' + 'ipt language="JavaScript" src="'+tl_loc0+'" type="text\/javascript">' + '<\/scr' + 'ipt>');
//]]>When I remove the whole thing, it works.
It doesn't help to remove the commenting // at the beginning and the end, which I don't know why they are not there. But is CDATA not allowed?