I'd say most such issues with extensions could be solved if they were "read-only", i.e. were prevented from inserting data into documents, making or adding data into outbound requests.
GET /realylongstringwithmeaningfulbits/{user identifier}