but zomg the splosions!

really, though, `app://{guid}` isn't secure.