The cause was that the newly(or old) created user had not set up their security questions. That somehow led to NS adding that object to the DOM, hidden, on all pages.