move extension detection to a standalone page
add privilege system