@imojito This is not a privacy issue (then we'd just get rid of HTTP altogether). It's a trust issue on when to update the URL callback. Th[…]