diff --git a/resources/static/dialog/controllers/dialog.js b/resources/static/dialog/controllers/dialog.js
index 25236e5db1f815516fbe76db3d6d2b5d61e781fc..62043fbc8b67e96be745d0aaeed25ff2cef6eeb7 100644
--- a/resources/static/dialog/controllers/dialog.js
+++ b/resources/static/dialog/controllers/dialog.js
@@ -84,6 +84,8 @@ BrowserID.Modules.Dialog = (function() {
 
   function fixupURL(origin, url) {
     var u;
+    if (typeof(url) !== "string")
+      throw "urls must be strings: (" + url + ")";
     if (/^http(s)?:\/\//.test(url)) u = URLParse(url);
     else if (/^\//.test(url)) u = URLParse(origin + url);
     else throw "relative urls not allowed: (" + url + ")";
diff --git a/resources/static/shared/validation.js b/resources/static/shared/validation.js
index e103085a0cf0bf3de414e0e2323c71ffd34e159b..d49f823719240f0d686f4711406fc7f529b0a821 100644
--- a/resources/static/shared/validation.js
+++ b/resources/static/shared/validation.js
@@ -7,6 +7,8 @@ BrowserID.Validation = (function() {
       tooltip = bid.Tooltip;
 
   bid.verifyEmail = function(address) {
+    if (typeof(address) !== "string")
+      return false;
     // Original gotten from http://blog.gerv.net/2011/05/html5_email_address_regexp/
     // changed the requirement that there must be a ldh-str because BrowserID
     // is only used on internet based networks.