Current solution: Do the main page and all resources and links through my custom scheme, and make sure they start with the same word, like foo:bar/actual/url instead of foo://actual/url so it knows they’re not going cross-site.