I think it should maybe explicitly say that it means that other preview extensions like json, pdf, etc. will not be able to preview other resources? Also, if simple, it might be nice to have one sentence about _how_ it gets around the same-origin policy.