This and many other features need to be bundled up behind a single permission prompt that gives the domain permission to be an app instead of a web site—and that permission should probably come with stricter restrictions on loading third-party resources.