Victim page. The link below carries a secret in its href attribute.

Control case (no transition — should be blocked): control