In its onbeforeunload function, a page specifies specify a string to be shown in the prompt. According to the spec in step 7:

The prompt shown by the user agent may include the string of the returnValue attribute, optionally truncated.

The majority of browsers take advantage of the word "may" in that step and do not include the page's string in that prompt:

• Firefox does not do so, and hasn't since Firefox 4. As they say in the relevant bug, they removed that ability as it was a security issue.
• Safari does not do so starting with version 9.1. They too consider this a security fix for the vulnerability that was assigned CVE-2009-2197 and noted in their release notes.
• Chrome and Opera have stopped doing so as of Chrome 51 and Opera 38. As with the other vendors, we consider using page-supplied text in a privileged-appearing dialog as a security fix.

Is it appropriate for the spec to follow the behavior of the browsers here?