Fix an XSS vulnerability in showing popups
Support new protocol for popups