nit: use window.location.protocol instead of `app://`