Wow, I never knew about this API. Seems very ripe for exploitation; check the referrer for an incoming request and route the other tab to a mirrored version of

Wow, I never knew about this API. Seems very ripe for exploitation; check the referrer for an incoming request and route the other tab to a mirrored version of the site, on a host you control, preferably with a "you've been logged out due to inactivity, enter your credentials" modal.