be more defensive about window.user
location.origin is OF THE DEVIL and webkit-only
remove logs