This is really cool, but...

Allowing third-party JavaScript execution on the client is a bold move. They better have both user- and admin-accessible way to disable this.