At first, I was loading the new tweet form inline. But since the client's code need to be injected in every webpage, because that's all I can do with the Safari

At first, I was loading the new tweet form inline. But since the client's code need to be injected in every webpage, because that's all I can do with the Safari Extension API, then I couldn't put the form inline. Here's why: I figured any malicious site owner could add some javascript code to submit the form with any text they want. Therefore any website could tweet something in your name. This is really bad, so I took this approach instead.