It does as well in a separate request.

There are 3 request locations that I've spotted, at least one to ajax.googlemaps.com, one to amazonaws.com and a few to openstreetmap.org (a.tile.openstreetmap.org and static.openstreetmap.org). Open Street Map provides the map tiles, a jQuery plugin and some CSS. ajax.googlemaps.com provides jQuery itself. I haven't found what AWS actually provides. I just thought it was amusing that this application designed to show off a "security hole" that tracks the user has to use the network in order to work, potentially tracking the user.