Good work. Hypothetical (ahem, rhetorical) question: if I made a blog which referenced a 1x1 png at an HTTP URL for my Facebook app or something, have I just successfully deanonymized you? Yup. Not to mention the bazillion other vectors I can use. I don’t say this to disparage your awesome work here, I’m just trying to dissuade developers from accessing the launcher from the common user browser.