X-Content-Type-Options: nosniff, a browser refuses a script that isn't labelled as JavaScript and a stylesheet that isn't labelled text/css, and stops guessing types elsewhere (MDN).registerProtocolHandler() needs HTTPS and works in Chrome and Firefox, not Safari. A custom scheme must start with web+ followed by lowercase letters, and the handler URL must be on the page's own origin (MDN).